Application/Control Number: 09/884,31 1 Page 2 

Art Unit: 2432 

EXAMINER'S COMMENTS 
Continued Examination Under 37 CFR 1. 1 14 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1 .1 7(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 
10/12/2010 has been entered. 

2. Claims 27-34 and 37-40 have been amended; claims 4-1 8, 20-22 were 
previously cancelled. Claims 1-3, 19 and 23-40 remain pending. 

3. Acknowledgement to applicant's amendment to claims 33-38. The claims have 
been reviewed, entered and found obviating to previously raised claim rejection under 
35 USC 101 as being directed to a non-statutory subject matter. Claim rejection to 
claims 33-38under 35 USC 101 is hereby withdrawn. 

EXAMINER'S AMENDMENT 

4. An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .31 2. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with Stephen Walder (Reg No. 41,534) on 01/10/2010. 
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The application has been amended as follows: 

• Please replace claim 1 with: 

1 . (Currently amended) A method, in a data processing system, for handling 
personally identifiable information, said method comprising: 

providing, in a computer of the data processing system , a first set of object 
classes, of an object model in an object oriented programming language, 
representing active entities in an information-handling process; 

providing, in said computer, a second object class, of the object model, 
representing personally identifiable information and associated rules in said 
information-handling process; and 

processing transactions, in the data processing system, involving said 
personally identifiable information, using said computer and said first set of object 
classes and said second object class of the object model, so as to enforce a 
privacy policy, wherein 

said rules define if and how said personally identifiable information is 
provided, by a first data user of the data processing system that previously 
requested the personally identifiable information from an active entity that is 
personally identifiable by the personally identifiable information, to a second data 
user of the data processing system that requests said personally identifiable 
information from the first data user , wherein said second object class, having 
said rules associated with said data, represents a filled paper form, including 
both collected data, collected from the active entity and including the personally 
identifiable information, and rules regarding said collected data specifying if and 
how the collected data is provided to the second data user, wherein the second 
data user sends an empty form including a policy to the first data user requesting 
the personally identifiable information, and wherein the first data user checks the 
policy included with the empty form to determine if disclosure of the personally 
identifiable information is permitted based on the policy included with the empty 
form and the rules regarding the collected data . 
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• Please cancel claim 3; 

• Please replace claim 27 with: 

27. (Currently amended) A computer system for handling personally 
identifiable information, said computer system comprising: 

a central processing unit (CPU), a computer-readable memory, and a 
computer readable, tangible storage device; 

program instructions, stored on the storage device for execution by the 
CPU via the memory, to provide a first set of object classes, of an object model in 
an object oriented programming language, representing active entities in an 
information-handling process; 

program instructions, stored on the storage device for execution by the 
CPU via the memory, to provide a second object class, of the object model, 
representing personally identifiable information and associated rules in said 
information-handling process; and 

program instructions, stored on the storage device for execution by the 
CPU via the memory, to process transactions involving said personally 
identifiable information, using said first set of object classes and said second 
object class of the object model, so as to enforce a privacy policy, wherein said 
rules define if and how said personally identifiable information is provided, by a 
first data user of the computer system that previously requested the personally 
identifiable information from an active entity that is personally identifiable by the 
personally identifiable information, to a second data user of the computer system 
that requests said personally identifiable information from the first data user, 
wherein said second object class, having said rules associated with said data, 
represents a filled paper form, including both collected data, collected from the 
active entity and including the personally identifiable information, and rules 
regarding said collected data specifying if and how the collected data is provided 
to the second data user, wherein the second data user sends an empty form 
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including a policy to the first data user requesting the personally identifiable 
information, and wherein the first data user checks the policy included with the 
empty form to determine if disclosure of the personally identifiable information is 
permitted based on the policy included with the empty form and the rules 
regarding the collected data . 

• Please replace claim 33 with: 

33. (Currently amended) A computer program product comprising a non- 
transitory computer-readable, tangible storage device and computer-readable 
program instructions stored on the computer-readable, tangible storage device to 
handle personally identifiable information, the computer-readable program 
instructions, when executed by a central processing unit (CPU): 

provide a first set of object classes, of an object model in an object 
oriented programming language, representing active entities in an information- 
handling process; 

provide a second object class, of the object model, representing 
personally identifiable information and associated rules in said information- 
handling process; and 

process transactions involving said personally identifiable information, 
using said first set of object classes and said second object class of the object 
model, so as to enforce a privacy policy, wherein said rules define if and how 
said personally identifiable information is provided, by a first data user that 
previously requested the personally identifiable information from an active entity 
that is personally identifiable by the personally identifiable information, to a 
second data user that requests said personally identifiable information from the 
first data user , wherein said second object class, having said rules associated 
with said data, represents a filled paper form, including both collected data, 
collected from the active entity and including the personally identifiable 
information, and rules regarding said collected data specifying if and how the 
collected data is provided to the second data user, wherein the second data user 
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sends an empty form including a policy to the first data user requesting the 
personally identifiable information, and wherein the first data user checks the 
policy included with the empty form to determine if disclosure of the personally 
identifiable information is permitted based on the policy included with the empty 
form and the rules regarding the collected data . 

Allowable Subject Matter 

5. Claims 1-2,19 and 23-40 are allowed. 

6. This communication warrants No Examiner's Reason for Allowance, applicant's 
reply make evident the reasons for allowance, satisfying the "record as a whole" proviso 
of the rule 37 CFR 1.104(e). Specifically, the substance of applicant's arguments pages 
21 -22 in view of pages 1 0-1 6 filed 1 0/1 2/201 0 are persuasive, as such the reasons for 
allowance are in all probability evident from the record and no statement is deemed 
necessary (see MPEP 1302.14). 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to HADI S. ARMOUCHE whose telephone number is 
(571)270-3618. The examiner can normally be reached on M-Th 7:30-5:00 and Fridays 
half day 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on (571) 272-3902. The fax phone number 
for the organization where this application or proceeding is assigned is 571 -273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/H. A./ 

HADI ARMOUCHE 
Examiner, Art Unit 2432 

/Benjamin E Lanier/ 

Primary Examiner, Art Unit 2432 



